# Additional Information

This section describes the additional information related to the Microsoft SQL Server Connector.

## Microsoft SQL Server Windows Service Account

Managed service accounts and Group-managed service accounts must be created in the Active Directory by the domain administrator.

> [!NOTE]
>
> If you want to aggregate service accounts, the Microsoft SQL Server Service account must be connected to Login User accounts.

For more information, refer to [Configure Windows service accounts and permissions - SQL Server](<https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?view=sql-server-ver16>).

## Windows Authentication and Kerberos

The following topics contain information for configuring a connection to the SQL server source using Windows authentication and the Kerberos authentication protocol that supports it.

### Windows Authentication

Windows authentication can go by many names. Some of the most common names include:

- Windows authentication
- Windows domain authentication
- Domain authentication
- Integrated authentication
- Kerberos authentication

In this topic, the terms "Windows authentication" and "Kerberos" are used.

> [!IMPORTANT]
>
> To configure Windows authentication, you must properly configure [Kerberos](<#kerberos>).

When you connect using a Windows user account, the SQL Server source validates the account name and password using the Windows principal token in the operating system. In other words, the user identity is validated by Windows, not the source. The source doesn't ask for a password and it doesn't validate the identity. Windows authentication is the default authentication mode. It is much more secure than SQL Server authentication. A connection made using Windows authentication is sometimes called a trusted connection, because SQL Server trusts the credentials provided by Windows.

Windows authentication supports the following:

- The Kerberos authentication scheme
- Password policy enforcement with regard to complexity validation for strong passwords
- Account lockout
- Password expiration

To properly support Windows authentication, the Virtual Appliance must be able to resolve the SQL server host, the key distribution center (KDC), and the default Kerberos realm.

By using Windows authentication, Windows groups can be created at the domain level and a login can be created on the SQL Server source for the entire group. Managing access at the domain level can simplify account administration.

For more information, refer to [Connecting through Windows Authentication](<https://learn.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode?view=sql-server-ver16#connecting-through-windows-authentication>) in the Microsoft documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

#### Windows Authentication Compatibility Check

To properly support Windows authentication, the Virtual Appliance must be able to resolve the SQL server host, the key distribution center (KDC), and the default Kerberos realm.

To check if the VA can resolve the necessary components, run the following command, replacing `<host_fqdn>` with each component's fully qualified domain name:

```text
nslookup <host_fqdn>
```

For example:

- Verify resolvability with the SQL server:

  ```text
  nslookup MYSQLSERVER.EXAMPLE.COM
  ```
- Verify resolvability with the KDC:

  ```text
  nslookup MYKDC.EXAMPLE.COM
  ```
- Verify resolvability with the Kerberos realm:

  ```text
  nslookup EXAMPLE.COM
  ```

> [!NOTE]
>
> You may to change your DNS configuration on Virtual Appliance. For more information on changing the DNS, refer to [Network Troubleshooting](<https://community.sailpoint.com/knowledge/Virtual-Appliance-Troubleshooting-Guide>).

### Kerberos

The SailPoint SQL Server connector supports Windows authentication using the Kerberos authentication scheme as an underlying protocol for authentication information exchange.

To provide a Login Module Configuration File and a Kerberos Configuration File, refer to [Base Configuration](<https://documentation.sailpoint.com/connectors/microsoft/sql_server/va/help/connecting.html#base-configuration>).

#### Prerequisites

- The SQLJDBCDriver.config and krb5.config files should be uploaded to the source
- Update the `useMssqlKerberosAuth` parameter in the source XML using the REST API.

  **useMssqlKerberosAuth**

  - Boolean
  - Default - `false`

  This parameter should be set to `true` when you need to connect to a Microsoft SQL server database with Kerberos authentication.

  ```json
  [
      {
          "op": "add",
          "path": "/connectorAttributes/useMssqlKerberosAuth",
          "value": true
      }
  ]
  ```

  > **Note**
  >
  > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

#### Login Module Configuration File

**Filename** - SQLJDBCDriver.config

> [!IMPORTANT]
>
> This file is mandatory to be provided for Windows Authentication. You can upload the file via [Base Configuration](<https://documentation.sailpoint.com/connectors/microsoft/sql_server/va/help/connecting.html#base-configuration>) tab. For more ways upload the file, refer to [Upload Configuration Files](<#upload-configuration-files>).

A login module configuration file consists of one or more entries, each specifying which underlying authentication technology should be used for a particular application or applications. The login module configuration file for this connector allows the SQL JDBC driver to acquire Kerberos credentials.

Each login module configuration file entry consists of a name followed by one or more login module-specific entries. Each entry is terminated by a semicolon. Groups of entries are enclosed by braces.

For more information, refer to *Creating a login module configuration file* in [Using Kerberos integrated authentication to connect to SQL Server](<https://learn.microsoft.com/en-us/sql/connect/jdbc/using-kerberos-integrated-authentication-to-connect-to-sql-server?view=sql-server-ver16#creating-a-login-module-configuration-file>) in the Microsoft documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

#### Kerberos Configuration File

**Filename** - krb5.config

The krb5.config file contains the Kerberos configuration information, including the locations of key distribution centers (KDCs), administration daemons for the Kerberos realms of interest, defaults for the current realm and for the Kerberos applications, and mappings of host names onto the Kerberos realms. This file must reside on all Kerberos clients.

The format of the krb5.config consists of section headings in square brackets. Each section can contain zero or more configuration variables (called relations), of the form:

```text
relation = relation-value
```

or

```text
relation-subsection = {
    relation= relation-value
    relation= relation-value
```

For more information, refer to [Creating a Kerberos configuration file](<https://learn.microsoft.com/en-us/sql/connect/jdbc/using-kerberos-integrated-authentication-to-connect-to-sql-server?view=sql-server-ver16#creating-a-kerberos-configuration-file>) in the Microsoft documentation.

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

## Upload Configuration Files

You can upload the required configuration files, SQLJDBCDriver.config and krb5.config, from the [Base Configuration](<https://documentation.sailpoint.com/connectors/microsoft/sql_server/va/help/connecting.html#base-configuration>) tab. This is the recommended method for providing these files.

Alternatively, you can upload the file with the following process:

1. Using FTP, SFTP, or any other transport means upload the file to one of the following locations in the Virtual Appliance:

   - `/opt/sailpoint/ccg/`
   - `/home/sailpoint/ccg/custom/`
2. Map the connector to the selected file location by adding the following entry into the source XML using the REST API, replacing `<config_file_path>` with your selected file location:

   **Attribute** - `configFilePath`

   **Value** - `<config_file_path>`

   For example:

   **Attribute** - `configFilePath`

   **Value** - `/opt/sailpoint/ccg/`

   > **Note**
   >
   > When Cloud Gateway is configured with MS SQL server connector, ensure the file specified in the `configFilePath` is also present on the Cloud Gateway machine at the same location.

   For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

   > **Important**
   >
   > Do not skip the `/` at the end of the path value.
   >
   > Once you upload the file to the selected location, the CCG service needs to be restarted on the Virtual Appliance. This is to make sure that the previous cached configuration file - if one exists - is removed and a fresh configuration file is used.